« Volver al listado

CVE-2022-33941

Estado: ModificadaCrítica (9.8)—

PowerCMS XMLRPC API provided by Alfasado Inc. contains a command injection vulnerability. Sending a specially crafted message by POST method to PowerCMS XMLRPC API may allow arbitrary Perl script execution, and an arbitrary OS command may be executed through it. Affected products/versions are as follows: PowerCMS 6.021 and earlier (PowerCMS 6 Series), PowerCMS 5.21 and earlier (PowerCMS 5 Series), and PowerCMS 4.51 and earlier (PowerCMS 4 Series). Note that all versions of PowerCMS 3 Series and earlier which are unsupported (End-of-Life, EOL) are also affected by this vulnerability.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Alfasado — Powercms

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-33941",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "vultures@jpcert.or.jp",
      "affectedData": [
        {
          "vendor": "Alfasado Inc.",
          "product": "PowerCMS XMLRPC API",
          "versions": [
            {
              "status": "affected",
              "version": "PowerCMS 6.021 and earlier (PowerCMS 6 Series), PowerCMS 5.21 and earlier (PowerCMS 5 Series), PowerCMS 4.51 and earlier (PowerCMS 4 Series), and PowerCMS 3 Series and earlier which are unsupported (End-of-Life, EOL)"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-09-08T08:15:07.957",
  "references": [
    {
      "url": "https://jvn.jp/en/jp/JVN76024879/index.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://www.powercms.jp/news/xmlrpc-api-provision-202208.html",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "vultures@jpcert.or.jp"
    },
    {
      "url": "https://jvn.jp/en/jp/JVN76024879/index.html",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.powercms.jp/news/xmlrpc-api-provision-202208.html",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "PowerCMS XMLRPC API provided by Alfasado Inc. contains a command injection vulnerability. Sending a specially crafted message by POST method to PowerCMS XMLRPC API may allow arbitrary Perl script execution, and an arbitrary OS command may be executed through it. Affected products/versions are as follows: PowerCMS 6.021 and earlier (PowerCMS 6 Series), PowerCMS 5.21 and earlier (PowerCMS 5 Series), and PowerCMS 4.51 and earlier (PowerCMS 4 Series). Note that all versions of PowerCMS 3 Series and earlier which are unsupported (End-of-Life, EOL) are also affected by this vulnerability."
    },
    {
      "lang": "es",
      "value": "La API PowerCMS XMLRPC proporcionada por Alfasado Inc. presenta una vulnerabilidad de inyección de comandos. El envío de un mensaje especialmente diseñado mediante el método POST a la API XMLRPC de PowerCMS puede permitir la ejecución arbitraria de secuencias de comandos Perl y un comando arbitrario del Sistema Operativo puede ser ejecutado por medio de él. Los productos/versiones afectados son los siguientes: PowerCMS versiones 6.021 y anteriores (PowerCMS 6 Series), PowerCMS 5.21 y anteriores (PowerCMS 5 Series) y PowerCMS versiones 4.51 y anteriores (PowerCMS 4 Series). Tenga en cuenta que todas las versiones de PowerCMS versiones 3 Series y anteriores que no son compatibles (fin de vida útil, EOL) también están afectadas por esta vulnerabilidad"
    }
  ],
  "lastModified": "2026-06-17T04:49:31.543",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:alfasado:powercms:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8260209D-6723-4FA5-8F94-55D35EA6F19A",
              "versionEndIncluding": "4.51"
            },
            {
              "criteria": "cpe:2.3:a:alfasado:powercms:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CFE5A5A9-FDBC-49E9-8B1C-7B3ED1F56287",
              "versionEndIncluding": "5.21",
              "versionStartIncluding": "5.0"
            },
            {
              "criteria": "cpe:2.3:a:alfasado:powercms:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BF7FF9CD-2DF1-43E6-A801-D50B806C8158",
              "versionEndIncluding": "6.021",
              "versionStartIncluding": "6.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "vultures@jpcert.or.jp"
}